tegwick
436c5fe585
All five NK-WP-0053 stages passed on generation 20261031T034845Z-a13dc92e2c61, the first capture after the 2026-10-30 bind split, operated by admin. Uncounted attempts are kept with their causes. The drill document gains the OpenBao platform-admin login that stage 1 silently requires. The LLDAP declaration moves ld-admin and the svc-* binds to active and admin to human-only; SI-X1 is closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
32 lines
2.2 KiB
JSON
32 lines
2.2 KiB
JSON
{
|
|
"schema": "netkingdom.identity-restore-drill.v1",
|
|
"work": "NK-WP-0054-T05 (post-split drill), NK-WP-0053 cadence",
|
|
"date": "2026-10-31",
|
|
"operator": "admin (founder)",
|
|
"verdict": "pass",
|
|
"generations": {
|
|
"20261031T034845Z-a13dc92e2c61": "stages 1-5"
|
|
},
|
|
"generation_context": "First daily capture after the 2026-10-30 LLDAP bind split (steps 1-10 and verify --old-admin-retired): the archived configuration binds ld-admin, svc-authelia and svc-privacyidea, and admin's password is the human-only one set at step 10.",
|
|
"stages": [
|
|
{"stage": 1, "name": "independent retrieval", "result": "pass", "receipt": "transfer.json",
|
|
"identity": "admin, OpenBao platform-admin session (auth/netkingdom, aal2) reading the Backup account custody"},
|
|
{"stage": 2, "name": "LLDAP", "result": "pass", "receipt": "lldap-recovery.json", "login_tested": "admin (post-split password)"},
|
|
{"stage": 3, "name": "privacyIDEA", "result": "pass", "receipt": "privacyidea-recovery.json"},
|
|
{"stage": 4, "name": "Authelia", "result": "pass", "receipt": "authelia-recovery.json", "login_tested": "admin (post-split password)",
|
|
"bind_note": "Authelia ran on the archived post-split configmap, i.e. the svc-authelia bind; the receipt does not name the bind account."},
|
|
{"stage": 5, "name": "by-user MFA", "result": "pass", "receipt": "privacyidea-mfa-recovery.json", "login_tested": "admin (realm coulomb)",
|
|
"bind_note": "user resolved through the restored resolver, which keeps the archived svc-privacyidea bind"}
|
|
],
|
|
"attempts_not_counted": [
|
|
{"receipt": "attempts/transfer-1-failed.json",
|
|
"cause": "no valid OpenBao platform-admin token in the operator shell; retrieve-identity.py reads the Backup credential from OpenBao and fails silently without one (drill document lacked the login step; added 2026-10-31)"},
|
|
{"receipt": "attempts/lldap-1-refused.json",
|
|
"cause": "given the failed transfer receipt; refused at input_validation before any password prompt"},
|
|
{"receipt": "attempts/privacyidea-mfa-platform-root.json",
|
|
"cause": "valid pass, but tested platform-root rather than admin; stage 5 rerun with admin"}
|
|
],
|
|
"si_x1_retired": true,
|
|
"next_due": "2027-01-31",
|
|
"secret_values_recorded": false
|
|
}
|